Which of the following can reduce the attack surface area in relation to Linux hardening?

Attack surface area reduction involves minimizing the total number of exposed vulnerabilities and entry points that an attacker can exploit to gain unauthorized access. Enforcing strong password strength and complexity policies via Pluggable Authentication Modules (PAM) systematically reduces the efficacy of automated dictionary attacks, credential stuffing, and brute-force authentication vectors against local and remote user accounts. By strengthening authentication rules (e.g., minimum length, character diversity, dictionary checks), the set of viable authentication pathways available to adversaries is dramatically constrained. This directly fortifies account access controls, thereby decreasing the system's operational attack surface and securing critical administrative entry points across the Linux operating environment.

A: Customizing login banners deters unauthorized access warnings or hides software versions, but does not remove or reduce functional entry points or authentication attack vectors. B: Directory count does not intrinsically affect system exposure or network entry points, as file system layout does not define service or credential attack vectors. C: Extending SSH connection timeouts increases potential resource consumption and exposure windows to denial-of-service or slow-rate brute-force connection attempts.

NIST Special Publication 800-123, "Guide to General Server Security", Section 3.1 "Securing the Operating System".

CIS Red Hat Enterprise Linux 8 Benchmark v1.0.0, Section 5.3 "Configure PAM Password Requirements".